December 2003 - cypherpunks-legacy

Re: Complying with the EAR [was: More Circumventing the ITAR]
by Michael Paul Johnson 17 Dec '03

17 Dec '03

On Thu, 30 Jan 1997, Sean Roach wrote: > At 11:14 AM 1/29/97 -0700, Michael Paul Johnson wrote: > >On Tue, 28 Jan 1997, Mark Rosen wrote: > > > >> I'm curious as to exactly what the ITAR/EAR/Whatever says specifically > >> about "unrestricted FTP sites." My program, Kremlin, is available for > > > >You should check the exact text yourself, but the way I read the EAR, you > >are not "exporting" strong cryptographic software without a license (exept > >to Canada, which needs no license) if you do things "such as" > >(1) have the guests to your site acknowledge that the EAR restricts > >export, (2) have the guests affirm that they can legally get the software > >(proper citizenship or residency & location), and (3) "check the address > >of the destination computer to see if it is in the USA" or Canada. The > >last one, I interpret rather loosely to mean that if the guest's email > >address domain isn't one commonly used in the USA or Canada, then I deny > >access. We all know that not all .com addresses are North American, but > >chances are really good that if the address ends in .ru, then the > >destination machine is probably not in North America. This is not a > >perfect way to prevent export, of course, but it is what the regulations > >say, as I read them. For a pointer to the regulations and to my access > >request form and crypto site, see http://www.sni.net/~mpj/crypto.htm > ... > An easy crack to that would be to request access from a hotmail, or > similair, account. This account would show up as being on US soil while the > account holder would not necessarily be so. In this way, someone with an > account ending in your .ru would get through because h[is/er] e-mail request > originated from inside the U.S. If that is the only chink in the armor you see, then you aren't looking very hard. The point of this system is not to prevent exports, but to (1) comply with the letter of the law by discouraging export in the specified manner, (2) to comply with the spirit of the law by reducing the number of exports of cryptographic software from the USA, while (3) making publication of strong cryptographic software in North America easy and safe from legal persecution. Without point (3), the national security of the USA would be harmed, IMHO, by the fact that proportionally more dishonest people (the ones the NSA and FBI are quict to draw attention to) than honest ones (the majority of the people who want to use strong cryptography to protect their privacy and business interests from the dishonest folks) would use strong cryptography. The only reason I can think of that the U. S. Commander-in-Chief and President of the United States of America and his staff have determined that export of strong cryptographic software can harm "national security" even when such software already is available outside of the USA, is that they are really more concerned about the numbers of people that use such software regularly, and therefore, they want to limit the total bandwidth of distribution capacity and ease of retrieval of such software. Export controls can effectively do both, even if they cannot realistically prevent export. Think about it. It was a pain to set up the EAR-compliant site that I set up compared to a simple site for global distribution, and few people would go through the hassle. Many major information services and ftp sites simply disallow strong cryptographic software rather than go through the hassle. Because of this, it is probably true that fewer people find, download, and use strong cryptographic software. Until more people set up more strong cryptographic software distribution sites and write more good, secure, robust, easy-to-use cryptographic software such that it is about as easy to find and use it as not to, the Feds win. Their point is proven. Fewer people use strong cryptography than would otherwise, and some small (but, to them, significant) percentage of those people who were discouraged from using strong cryptographic software might have used that software in a criminal activity. Too bad about the good guys who could have prevented computer crime or worse with the same technology, huh? http://www.sni.net/~mpj/crypto.htm Michael Paul Johnson Opinions herein are not necessarily Exabyte's. Work: mpj(a)exabyte.com http://www.exabyte.com Personal: mpj(a)csn.net http://www.csn.net/~mpj BBS 303-772-1062

2 1

[STEGO] Blowfish
by nobody＠zifi.genetics.utah.edu 17 Dec '03

17 Dec '03

Timmy C[rook] Maytag's abysmal grammar, atrocious spelling and feeble responses clearly identify him as a product of the American education system. /\ \ / /\ //\\ .. //\\ Timmy C[rook] Maytag //\(( ))/\\ / < `' > \

1 0

RE: Fighting the cybercensor
by azur＠netcom.com 17 Dec '03

17 Dec '03

[big snip] >If every time someone made a mistake they got >punished, without the opportunity to understand the error and without the >opportunity to make corrections, they would be a psychological wreck. Yes, you have certainly pointed out a property of AP, insofar as teaching is concerned. The reality of the physical world is that some mistakes, for example steping off a cliff, are immediately punished by a fall and possibly death. The 'student' may or may not learn for the experience but other students who are witness most certainly will. >If every time someone made mistake they got assassinated, not only would no >one wish to do anything for fear of losing their lives, creating a >"society" of timid sheep, there probably wouldn't be many people remaining >to savor the triumph of being superior. I sincerely doubt that many would use AP to right small slights, anymore than many now kill others for the same reasons. The world has always been inhabited by bullies and tyrants who cared little of what harm they caused others. An AP system would quickly eliminate bullies and tyrants. > >AP is just another form of war. You can bet that if assassinations >increased a hundred fold as a result of your method, not only "governments" >but some very bright people would get together to figure out a defense >against it, for they also would be "at risk". I think the reaction of the society as a whole to AP would depend on what its perceived overall results were. If assassinations of scum and tyrants increased a hundred fold it would hardly be noticed on any political radar screen, except the bullies and tyrants. --Steve

1 0

Re: Fighting the cybercensor. (fwd)
by azur＠netcom.com 17 Dec '03

17 Dec '03

>> Its worth noting that the origin of property is theft. In the case of the > > BULLSHIT. BULL FUCKING SHIT. The origin of property is labor. Claiming >that _my_ property is the result of ME stealing, and hence what I OWN belongs >to the community IS theft. I work, and as the result of that work something is >created. That something is MINE to do with as I will. If I choose to sell that >work for money, that money is mine. If I trade that money for shoes, those >shoes are mine. THere is no theft involved. Tell this to the Native Americans. --Steve

2 1

Re: PGPMail Log File
by Mutatis Mutantdis 17 Dec '03

17 Dec '03

On 31 Jan 1997 09:27:45 -0500, you wrote: >At 02:22 AM 1/31/97 +0000, "Robert Rothenburg 'Walking-Owl'" >< WlkngOwl(a)unix.asb.comwrote: >> Is there a way to disable the \WINDOWS\PGPW_32.LOG? >> In subtle ways it's a security hole if left to accumulate over time, >> since it keeps records of which keys you encrypted messages to. >> [..] >> I understand in certain group/corporate environs one would want >> logging; in others, one doesn't need it or should have the option (in >> an easily found place) to wipe it every once in a while. >This is a damn good question. I do NOT have the "write to a log file" >option slected in the misc. tab and it STILL writes a log file. How DO >we disable this? Well, I just found that option to uncheck it (thanks to your message) so I'll try it w/the log file unchecked and see what happens. (Duh!) Rob

1 0

RE: Fighting the cybercensor
by Steve Schear 17 Dec '03

17 Dec '03

[big snip] >If every time someone made a mistake they got >punished, without the opportunity to understand the error and without the >opportunity to make corrections, they would be a psychological wreck. Yes, you have certainly pointed out a property of AP, insofar as teaching is concerned. The reality of the physical world is that some mistakes, for example steping off a cliff, are immediately punished by a fall and possibly death. The 'student' may or may not learn for the experience but other students who are witness most certainly will. >If every time someone made mistake they got assassinated, not only would no >one wish to do anything for fear of losing their lives, creating a >"society" of timid sheep, there probably wouldn't be many people remaining >to savor the triumph of being superior. I sincerely doubt that many would use AP to right small slights, anymore than many now kill others for the same reasons. The world has always been inhabited by bullies and tyrants who cared little of what harm they caused others. An AP system would quickly eliminate bullies and tyrants. > >AP is just another form of war. You can bet that if assassinations >increased a hundred fold as a result of your method, not only "governments" >but some very bright people would get together to figure out a defense >against it, for they also would be "at risk". I think the reaction of the society as a whole to AP would depend on what its perceived overall results were. If assassinations of scum and tyrants increased a hundred fold it would hardly be noticed on any political radar screen, except the bullies and tyrants. --Steve

1 0

Re: Complying with the EAR [was: More Circumventing the ITAR]
by Michael Paul Johnson 17 Dec '03

17 Dec '03

On Thu, 30 Jan 1997, Sean Roach wrote: > At 11:14 AM 1/29/97 -0700, Michael Paul Johnson wrote: > >On Tue, 28 Jan 1997, Mark Rosen wrote: > > > >> I'm curious as to exactly what the ITAR/EAR/Whatever says specifically > >> about "unrestricted FTP sites." My program, Kremlin, is available for > > > >You should check the exact text yourself, but the way I read the EAR, you > >are not "exporting" strong cryptographic software without a license (exept > >to Canada, which needs no license) if you do things "such as" > >(1) have the guests to your site acknowledge that the EAR restricts > >export, (2) have the guests affirm that they can legally get the software > >(proper citizenship or residency & location), and (3) "check the address > >of the destination computer to see if it is in the USA" or Canada. The > >last one, I interpret rather loosely to mean that if the guest's email > >address domain isn't one commonly used in the USA or Canada, then I deny > >access. We all know that not all .com addresses are North American, but > >chances are really good that if the address ends in .ru, then the > >destination machine is probably not in North America. This is not a > >perfect way to prevent export, of course, but it is what the regulations > >say, as I read them. For a pointer to the regulations and to my access > >request form and crypto site, see http://www.sni.net/~mpj/crypto.htm > ... > An easy crack to that would be to request access from a hotmail, or > similair, account. This account would show up as being on US soil while the > account holder would not necessarily be so. In this way, someone with an > account ending in your .ru would get through because h[is/er] e-mail request > originated from inside the U.S. If that is the only chink in the armor you see, then you aren't looking very hard. The point of this system is not to prevent exports, but to (1) comply with the letter of the law by discouraging export in the specified manner, (2) to comply with the spirit of the law by reducing the number of exports of cryptographic software from the USA, while (3) making publication of strong cryptographic software in North America easy and safe from legal persecution. Without point (3), the national security of the USA would be harmed, IMHO, by the fact that proportionally more dishonest people (the ones the NSA and FBI are quict to draw attention to) than honest ones (the majority of the people who want to use strong cryptography to protect their privacy and business interests from the dishonest folks) would use strong cryptography. The only reason I can think of that the U. S. Commander-in-Chief and President of the United States of America and his staff have determined that export of strong cryptographic software can harm "national security" even when such software already is available outside of the USA, is that they are really more concerned about the numbers of people that use such software regularly, and therefore, they want to limit the total bandwidth of distribution capacity and ease of retrieval of such software. Export controls can effectively do both, even if they cannot realistically prevent export. Think about it. It was a pain to set up the EAR-compliant site that I set up compared to a simple site for global distribution, and few people would go through the hassle. Many major information services and ftp sites simply disallow strong cryptographic software rather than go through the hassle. Because of this, it is probably true that fewer people find, download, and use strong cryptographic software. Until more people set up more strong cryptographic software distribution sites and write more good, secure, robust, easy-to-use cryptographic software such that it is about as easy to find and use it as not to, the Feds win. Their point is proven. Fewer people use strong cryptography than would otherwise, and some small (but, to them, significant) percentage of those people who were discouraged from using strong cryptographic software might have used that software in a criminal activity. Too bad about the good guys who could have prevented computer crime or worse with the same technology, huh? http://www.sni.net/~mpj/crypto.htm Michael Paul Johnson Opinions herein are not necessarily Exabyte's. Work: mpj(a)exabyte.com http://www.exabyte.com Personal: mpj(a)csn.net http://www.csn.net/~mpj BBS 303-772-1062

1 0

Georgia court hears testimony in anonymity case, from TNNN
by Declan McCullagh 17 Dec '03

17 Dec '03

---------- Forwarded message ---------- Date: Fri, 31 Jan 1997 08:33:44 -0800 (PST) From: Declan McCullagh <declan(a)well.com> To: fight-censorship(a)vorlon.mit.edu Subject: Georgia court hears testimony, future of free speech, from TNNN The Netly News Network http://netlynews.com/ Brick By Brick by Declan McCullagh (declan(a)well.com) January 31, 1997 ATLANTA, Ga.-- A federal judge heard testimony yesterday in a landmark case challenging a Georgia law that forbids anonymity online. The ACLU filed the lawsuit -- the first-ever challenge to a state Net-censorship statute -- last September on behalf of 14 plaintiffs, arguing that the statute is unconstitutional. The law also criminalizes the "unauthorized" use of company names online. It is so broadly written, the ACLU claims, that America Online screen names could be considered illegal. Yesterday's hearing was designed to educate U.S. District Court Judge Marvin Shoob about the Net, in much the same way that lawyers educated a three-judge panel that struck down the Communications Decency Act in Philadelphia in June 1996. It began with a Georgia Tech professor who painstakingly demonstrated how the Internet works. "This pointing device in the middle of the screen is the cursor," he said. The lawsuit is one of many that will shape the future of free expression in cyberspace -- and new media. The Georgia challenge seems straightforward, but in truth is a key part of the ACLU's strategy to cement a foundation of legal precedents that will build on one another, brick by statutory brick, and solidify into a framework for free speech on the Internet. The most fierce battlefield, however, will be in state capitols and courtrooms like these. More than 20 states already have launched various offensives against the Net, but the ACLU is choosing its battles carefully. Depending on how Judge Shoob rules, near-perfect anonymous speech may, for the first time in history, be completely legal -- at least in one federal district. In a move that could derail congressional attempts to rehabilitate the CDA if the high court strikes it down, the ACLU assailed a New York State law banning sexual images that are "harmful to minors." The organization also is planning to sue in Virginia, Florida and California, highlighting a different legal point in each case. True, the decisions won't be binding on other courts -- unlike, say, a U.S. Supreme Court ruling -- but in such a new area of the law, judges will grasp at even district court precedents. "You can't underestimate the importance," said ACLU attorney Chris Hansen. "The law works through precedent. Each case builds on the one before it." Key to the strategy is the argument that states can't regulate speech on the Internet at all. It's a nuclear bomb of a legal theory, which relies on the Constitution's commerce clause and on Supreme Court cases that bar states from controlling "commerce that takes place wholly outside of the state's borders." The coalition's brief offers Usenet newsgroups as an example: "The posting of this message in California, therefore, may subject the California author to prosecution in Georgia under the Act." The state countered that local standards should always apply. Daniel Formby, Georgia's deputy attorney general, said yesterday: "You do not have to enter a state to violate its laws." Free-speech victories in states such as Georgia would permit netizens to bypass the strict controls on television and radio that ban the transmission of "indecent" words or images. When the Internet starts carrying movies and soaps, the stronger free-speech standards of cyberspace will extend to those broadcasts. "We gain stronger First Amendment rights for other media when they converge, as the Internet absorbs other technologies," said ACLU attorney Ann Beeson. Sitting quietly in the rear of the Atlanta courtroom throughout the hearing was State Rep. Don Parsons, who with the Democratic leadership introduced the Georgia law last spring. Parsons insists the ACLU's challenge is wrongheaded. Does the law ban anonymous speech? "Certainly not! Absolutely not!" he claimed. So what was the purpose behind the the law? To prevent fraud, said Parsons. But that's not what I found. The genesis of the bizarre Georgia law lies not in policies as much as in rank statehouse politics. I went looking for Georgia's Speaker of the House and found him in his office. He leaned back in his chair and chewed on a cigar. A 72-year old Democrat, Thomas Murphy has reigned over the state House of Representatives for 24 years from an office studded with stuffed rabbits and bobcats and conveniently adjacent to the House floor. Yesterday, he declined to discuss the measure. "I can't tell you anything about it because I don't know anything about it or computers or the Internet or anything like that," he said. But he knows politics, and his enemies, especially Rep. Mitchell Kaye, a fellow who fancies himself the Newt Gingrich of the Georgia legislature. Like Gingrich, Kaye is a technocratic Republican hailing from bluenose Cobb County, and like pre-1994 Gingrich, he sees himself as waging guerrilla warfare against a corrupt and entrenched Democratic majority. Dem leaders are equally uncomplimentary. "None of us likes Mr. Kaye... No manners towards anyone. He tries to cause all the confusion he can," Speaker Murphy grumbled. Indeed, the whole statutory mess began shortly after Kaye created his own web site, www.gahouse.com, which he uses to post legislation, contact information and some partisan pages for his conservative caucus. It proved popular, drawing thousands of visitors a week -- and the wrath of lawmakers such as Speaker Murphy, longtime veterans of traditional machine politics. It was Kaye's use of the state seal on his site -- even with appropriate disclaimers -- that handed Democrats a way to muzzle him through the law the ACLU has challenged. The irony is, of course, that the Georgia Democrats never intended to ban all anonymous and pseudonymous discussions. They never believed they'd be attacked in court by a team of New York City lawyers. But by punishing anyone who "uses any individual name... to falsely identify the person" -- even without intent to deceive -- their law censors not just Mitchell Kaye, but netizens as well. "The last thing they want is sunshine on this case," said the upstart Republican, who joined the suit as one of the plaintiffs. "They pass a lot of unconstitutional legislation around here." ###

1 0

Re: Fighting the cybercensor. (fwd)
by Steve Schear 17 Dec '03

17 Dec '03

>> Its worth noting that the origin of property is theft. In the case of the > > BULLSHIT. BULL FUCKING SHIT. The origin of property is labor. Claiming >that _my_ property is the result of ME stealing, and hence what I OWN belongs >to the community IS theft. I work, and as the result of that work something is >created. That something is MINE to do with as I will. If I choose to sell that >work for money, that money is mine. If I trade that money for shoes, those >shoes are mine. THere is no theft involved. Tell this to the Native Americans. --Steve

1 0

Key Security Question
by Z.B. 17 Dec '03

17 Dec '03

My computer went into the shop a few days ago, and I was unable to take my PGP keys off it before it went in. What are the security risks here? If the repairman chooses to snoop through the files, what would he be able to do with my key pair? Will I need to revoke the key and make a new one, or will I be relatively safe since he doesn't have my passphrase? Zach Babayco zachb(a)netcom.com <-------finger for PGP public key If you need to know how to set up a mail filter or defend against emailbombs, send me a message with the words "get helpfile" (without the " marks) in the SUBJECT: header, *NOT THE BODY OF THE MESSAGE!* I have several useful FAQs and documents available.

3 2

Constitutional Right to Annoy?
by Martin Minow 17 Dec '03

17 Dec '03

Today's New York Times web page's Cybertimes section has an article on a new lawsuit that claims a constitutional right to annoy. Among other things, annoy.com will provide a way to "send anonymous e-mail messages to public figures." They're suing the CDA. http://www.nytimes.com/library/cyber/week/013197annoy.html (Assuming I retyped it correctly.) Martin Minow minow(a)apple.com

1 0

RC5-12/32/5 contest solved. Who gets a credit?
by Yuri Sorkin 17 Dec '03

17 Dec '03

stewarts(a)ix.netcom.com Tue, 28 Jan 1997 21:37:57 -0800 At 09:55 PM 1/28/97 +0100, Germano Caronni <caronni(a)tik.ee.ethz.ch> wrote: >challenge: RC5-32/12/5 >time: from start of contest until Tue Jan 28 21:54:58 1997 >method: massive distributed coordinated keysearch, details later which was a bit slower than Ian Goldberg's crack, but pretty close. --------------------------------------------------------------------------- Huh!? Goldbeg's announce states that he spent about 3.5 hours, i.e. a solution came not earlier than 12.30 PST, while Caronni got it at 11.55 am PST. Yuri Sorkin

1 0

Re: CAST
by John Young 17 Dec '03

17 Dec '03

For a paper on CAST see: http://www.nortel.com/entprods/entrust/cast.html "Constructing Symmetric Ciphers Using the CAST Design Procedure" By Carlisle M. Adams

1 0

CAST
by Ng Pheng Siong 17 Dec '03

17 Dec '03

Hi, Attended a presentation by Milkyway, vendor of the BlackHole firewall, which also does VPN. Supposedly the symmetric cipher used in the VPN is called CAST. Anyone has any info on it? TIA. Cheers. -- Ng Pheng Siong <ngps(a)pacific.net.sg> * Pacific Internet Pte Ltd * Singapore PGP: send mail with subject "send pgp key".

1 0

Constitutional Right to Annoy?
by Martin Minow 17 Dec '03

17 Dec '03

Today's New York Times web page's Cybertimes section has an article on a new lawsuit that claims a constitutional right to annoy. Among other things, annoy.com will provide a way to "send anonymous e-mail messages to public figures." They're suing the CDA. http://www.nytimes.com/library/cyber/week/013197annoy.html (Assuming I retyped it correctly.) Martin Minow minow(a)apple.com

1 0

"Secret" Postal Device stolen
by Jim Ray 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- from http://www.herald.com/dade/digdocs/021949.htm Postal Service offers $25,000 reward for stolen . . . something By ARNOLD MARKOWITZ Herald Staff Writer U.S. mail carriers carry more than just the U.S. mail. They carry something else so secret that nobody outside the Postal Service knows about it -- except four crooks who steal them from letter carriers on the streets of Miami. There's a $25,000 reward for tips producing capture and conviction. ... Comments? Please direct any replies for the list to me also, as I am still on Ray's FCPUNX, which I suppose makes this list double-filtered for me now, if a little delayed. :-) Typically, I now care what the mystery device is, since the occasionally-disgruntled ones don't want me to know. JMR -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQEPAwUBMvIhGzUhsGSn1j2pAQEp5wfPQ1YsiZviksusdbdVQHBz9yKMOSt5z3Ue Utlmxzx8RExqjaTc/cSLORf55pBWbJiDFB+a+ev09I2iZujq7nlNNCZNI0NaHw2L RObAjBQ4YT7sekWYMw81y08zH9x49OmAhh7CCh2qzh5ZyQ0qc3YdFzmc8F00+jdW J9ZsXSvJaBS+Jvh/eIPH+IlD873hyk6T4Nrayt0xt2z6Ajvst0XK5vOLkeJobZg3 +x8IyS26/bcrWGkKD/4rK81/QDmLIyHG7oWzaJAR1q6UKCad0C1w6/i2dwWtWV1v RyXfyYTgXi8XPbieBL7RZmP0j3A0xqlCr4PASMuZskBa+g== =Kspp -----END PGP SIGNATURE----- Regards, Jim Ray <jmr(a)shopmiami.com> DNRC Minister of Encryption Advocacy One of the "legitimate concerns of law enforcement" seems to be that I was born innocent until proven guilty and not the other way around. -- me http://shopmiami.com/prs/jimray/ PGP id.A7D63DA9 98 1F 39 BA 93 86 B4 F5 57 52 64 0E DA BA 2C 71

1 0

Re: PGPMail 4.5 Released!
by Duncan Frissell 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- At 06:29 AM 1/31/97 -0500, you wrote: >And what happened to the $29 discount price they proposed for 2.6.3 users and viuacrypt users!!!!!!!!!!!! > I just email PGP sales with that question. DCF -----BEGIN PGP SIGNATURE----- Version: 4.5 iQCVAgUBMvJBCIVO4r4sgSPhAQEZ4wP/RWERsyjzsVURKR5rBZx3DKoj6dDDRvIP vNGbE3UnI/hqiRaZSf6P/36MnM2dQ8yIbbmlvsWV3N4m9moBUnvY6hy3elbwFTkE P+cICHcm3S0uW68aZ/vKK4sasg+WJgd+YLBwdQWkZc8GBn8Ut6mJE7sVXEiJWNMC WgFjwMALh7A= =j4+j -----END PGP SIGNATURE-----

2 1

Re: Cats Out of Bags
by sameer 17 Dec '03

17 Dec '03

> > "Other governments were upset with the 56-bit export allowance. > > They said it was going to undermine their national security." > > On this point, the other governments are correct. > It really _is_ tougher to maintain a nation-state when your > former subjects can have private conversations with each other > and with other governments' former subjects...... > And even 56 bits is a start. Full strength crypto is already available worldwide. It makes not one iota of difference. -- Sameer Parekh Voice: 510-986-8770 President FAX: 510-986-8777 C2Net http://www.c2.net/ sameer(a)c2.net

1 0

Key Security Question
by Z.B. 17 Dec '03

17 Dec '03

My computer went into the shop a few days ago, and I was unable to take my PGP keys off it before it went in. What are the security risks here? If the repairman chooses to snoop through the files, what would he be able to do with my key pair? Will I need to revoke the key and make a new one, or will I be relatively safe since he doesn't have my passphrase? Zach Babayco zachb(a)netcom.com <-------finger for PGP public key If you need to know how to set up a mail filter or defend against emailbombs, send me a message with the words "get helpfile" (without the " marks) in the SUBJECT: header, *NOT THE BODY OF THE MESSAGE!* I have several useful FAQs and documents available.

1 0

Re: CAST
by C. Kuethe 17 Dec '03

17 Dec '03

On Fri, 31 Jan 1997, Ng Pheng Siong wrote: > Hi, > > Attended a presentation by Milkyway, vendor of the BlackHole firewall, which also does VPN. > Supposedly the symmetric cipher used in the VPN is called CAST. Anyone has any info on it? > TIA. Cheers. It's a canadian cipher. It's inventors have the initials C.A. and S.T. pure coincidence they say. it's got a little write-up in Appl. Crypto 2, and I'll post anything I can about it as soon as I get home. I don't have my copy of ac2 on me... I do remember that it's patented, and you have to talk to these folks for licences I believe.... more to come later. PLUR chris -- Chris Kuethe <ckuethe(a)gpu.srv.ualberta.ca> LPGV Electronics and Controls <c100305(a)wolfcreek.cs.ualberta.ca> http://www.ualberta.ca/~ckuethe/ RSA in 2 lines of PERL lives at http://www.dcs.ex.ac.uk/~aba/rsa/ print pack"C*",split/\D+/,`echo "16iII*o\U@{$/=$z;[(pop,pop,unpack"H*",<> )]}\EsMsKsN0[lN*1lK[d2%Sa2/d0<X+d*lMLa^*lN%0]dsXx++lMlN/dsM0<J]dsJxp"|dc`

1 0

Re: Cats Out of Bags
by Bill Stewart 17 Dec '03

17 Dec '03

> "When I talk to other governments," [David L. Aaron] said, > "they still don't feel that the cat is out of the bag." Aaron's denying that the cat is out of the bag? He was fashionably dressed in a Lion Tamer's outfit, waving a whip, and trying to herd hundreds of small furry mammals to jump through a hoop and back into a clawed-up army duffel-bag! "Cats? Haven't seen any cats around here! Pay no attention to these,umm, Siberian Hamsters that I'm evaluating for export approval." > "Other governments were upset with the 56-bit export allowance. > They said it was going to undermine their national security." On this point, the other governments are correct. It really _is_ tougher to maintain a nation-state when your former subjects can have private conversations with each other and with other governments' former subjects...... And even 56 bits is a start. # Thanks; Bill # Bill Stewart, +1-415-442-2215 stewarts(a)ix.netcom.com # You can get PGP outside the US at ftp.ox.ac.uk/pub/crypto/pgp # (If this is a mailing list, please Cc: me on replies. Thanks.)

1 0

Re: Cats Out of Bags
by Vladimir Z. Nuri 17 Dec '03

17 Dec '03

PJ wrote me in email: >A slight correction. The ``bernstein etc.'' cases are not about the >right to have strong crypto. There is no United States law forbidding >one from having or using crypto, hard, soft, or squishy. Those cases >challenge regulations that keep one from publishing information about >crypto including cryptographic software. Even if it were made illegal >to use hard crypto, it would still be a violation of the First >Amendment for the government to require a license before one is >allowed to publish information about crypto or anything else. I consider it a violation of free speech if the government made "hard crypto" illegal. yes, these cases are generally challenging the publishing aspects of crypto in the US, but this is not what I consider the most important constitutional ingredient in favor of crypto. crypto is essentially a kind of speech, or communication. hence restricting it would be like outlawing a certain foreign language that the government doesn't understand. in my opinion, this is the most important, root case to be made for the use of crypto in this country. publishing crypto algorithms is only a side issue compared to this, imho. so the bottom line is this: crypto regulations can be challenged under the idea that they are restricting freedom of the press, i.e. for academics to discuss algorithms, or it can be challenged under freedom of speech issues, i.e. everyone has the right to use codes for whatever purpose. currently because the regulations prohibit the "export" of crypto code, the first route is the basic challenge that makes the most sense. but I'd like to see the ITAR challenged on the second grounds as well, i.e. as a free speech issue. there's less reason when the gov't is not trying to regulate domestic crypto, but it might be a relevant angle in the export debate. BTW, I understand that there are cases being made by Karn, Junger, and Bernstein, is that correct? with Junger being the most recent? does anyone have web pages dedicated to each one of these? thanks;

1 0

Quick question
by Chad Robinson 17 Dec '03

17 Dec '03

How does the current Linux IPSEC release work? Is it a kernel patch or module? A daemon? I'd love to try this out on a local LAN here to see it in action, but don't have too much time these days. Best regards, Chad --------------------------[ Chad Robinson (Task) ]---------------------------- Senior Systems Analyst chadr(a)brttech.com BRT Technical Services Corporation http://www.brttech.com/~chadr -----------------[ Why is `abbreviation' such a long word? ]------------------

1 0

RC5-12/32/5 contest solved. Who gets a credit?
by Yuri Sorkin 17 Dec '03

17 Dec '03

stewarts(a)ix.netcom.com Tue, 28 Jan 1997 21:37:57 -0800 At 09:55 PM 1/28/97 +0100, Germano Caronni <caronni(a)tik.ee.ethz.ch> wrote: >challenge: RC5-32/12/5 >time: from start of contest until Tue Jan 28 21:54:58 1997 >method: massive distributed coordinated keysearch, details later which was a bit slower than Ian Goldberg's crack, but pretty close. --------------------------------------------------------------------------- Huh!? Goldbeg's announce states that he spent about 3.5 hours, i.e. a solution came not earlier than 12.30 PST, while Caronni got it at 11.55 am PST. Yuri Sorkin

1 0

Re: PGPMail 4.5 Released!
by Alan 17 Dec '03

17 Dec '03

On Fri, 31 Jan 1997, Duncan Frissell wrote: > -----BEGIN PGP SIGNED MESSAGE----- > > At 06:29 AM 1/31/97 -0500, you wrote: > >And what happened to the $29 discount price they proposed for 2.6.3 users and viuacrypt users!!!!!!!!!!!! > > > > I just email PGP sales with that question. I just got off the phone with PGP sales. Currently PGPMail is only available off if the web site for download. The version on disk will be available sometime mid February. So it looks like if you want it now it is going to cost you $149. If you wait until mid February, you can get it at the lower price (plus $10 shipping and handling). BTW, it does use SSL on the order form, though I have my doubts about the security of sending form data from an insecure page to a secure form cgi.

1 0